A flaw in the Linux kernel BPF verifier allows an unprivileged user to craft a program that performs speculative pointer arithmetic without maintaining correct register bounds invariants. The bug leads to an inconsistent state in the verifier’s register tracking, which can potentially be exploited to bypass bounds checks and read or write arbitrary kernel memory, thereby enabling privilege escalation. The impact is confined to the kernel context, but since BPF programs run with user space privileges, an attacker can elevate privileges with a crafted BPF program.

The vulnerability affects the Linux kernel, specifically the BPF subsystem that validates byte‑code programs. All released kernel versions that include the BPF verifier before the security fix are affected; exact version ranges are not specified, so any kernel where the BPF verifier has not been patched is potentially vulnerable.

The CVSS score is not provided, but the lack of an EPSS score indicates no data on current exploit prevalence. The vulnerability is not listed in the CISA KEV catalog. Because the flaw operates in speculative execution paths of the BPF verifier, an attacker with the ability to upload a BPF program can trigger the bug and potentially manipulate kernel memory. The exploit requires knowledge of the BPF byte‑code format and the ability to generate a program that exercises the specific verifier path. While proof‑of‑concept exploitation may not be publicly documented, the underlying flaw exposes a serious kernel escalation vector should it be actively leveraged.